diff --git a/tddp-client/README.md b/tddp-client/README.md
index f9dcb77..8f95844 100644
--- a/tddp-client/README.md
+++ b/tddp-client/README.md
@@ -3,7 +3,7 @@
 A proof-of-concept python client to talk to a TP-Link device using the **TP-Link Device Debug Protocol (TDDP)**.
 
 TDDP is implemented across a whole range of TP-Link devices including routers, access points, cameras and smartplugs.
-TDDP can read and write a device's configuration and issue special commands. On the HS110 SmartPlug it uses UDP port 1040, but might use different ports on other devices.
+TDDP can read and write a device's configuration and issue special commands. UDP port 1040 is used send commands, replies come back on UDP port 61000. This client has been tested with a TP-Link Archer C9 Wireless Router and TP-Link HS-110 WiFi Smart Plug.
 
 TDDP is a binary protocol documented in patent [CN102096654A](https://www.google.com/patents/CN102096654A?cl=en).
 
@@ -12,8 +12,17 @@ Data is returned DES-encrypted and requires the username and password of the dev
 
 #### Usage ####
 
-   `./tddp-client.py -t <ip> -u username -p password -c [test1|test2|test3]`
+   `./tddp-client.py -t <ip> -u username -p password -c 0A`
 
 Provide the target IP using -t. You can provide a username and password, otherwise admin/admin is used as a default. They are necessary to decrypt the data that is returned.
 
-Only three basic data readout commands (`test1, test2, test3`) are implemented. They are named test since it is unclear what type of data they might read out on different type of devices.
+Provide the command as a two-character hex string, e.g. -c 0A. What type of data a command might read out will be different for various TP-Link devices.
+
+#### Example ####
+Reading out the WAN link status on an Archer C9 in default configuration shows the link is down (0):
+   ```
+   ./tddp-client.py -t 192.168.0.1 -c 0E
+   Request Data: Version 02 Type 03 Status 00 Length 00000000 ID 0001 Subtype 0e
+   Reply Data:   Version 02 Type 03 Status 00 Length 00000018 ID 0001 Subtype 0e
+   Decrypted:    wan_ph_link 1 0
+   ```